Description: List of subprocessors of the Interactive Paper GmbH
Attached you find a list of all subprocessors of the products and services provided by the Interactive Paper GmbH.
| Subprocessor | Address | Purpose | Mandatory / Optional | Location of data processing | Personal data processed |
|---|---|---|---|---|---|
| Grunewald GmbH | Lindenbergstraße 44, 34123 Kassel, Germany | Production partner / processing of address data for postal dispatch | Optional, only if address data is exchanged | Germany | Address data of end-users |
| MRD GmbH | Siegener Straße 411, 57258 Freudenberg, Germany | Production partner / processing of address data for postal dispatch | Optional, only if address data is exchanged | Germany | Address data of end-users |
| DigitalOcean EU B.V. - Zweigniederlassung Deutschland | Am Sandtorkai 68, 20457 Hamburg, Germany | Hosting and infrastructure services for storing and processing data. | Mandatory | Germany (DigitalOcean Data Center) | Personal Data as determined by the Controller. |
| Artisan Colour | 8970 E Bahia Dr, Scottsdale, AZ 85260, United States | Production partner / processing of address data for postal dispatch | Optional, only if address data is exchanged and mailed out in the United States | United States | Address data of end-users Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Stripe, Inc. | 354 Oyster Point Blvd, South San Francisco, CA 94080, United States | Payment processing and subscription billing. Used when a client purchases or renews a paid subscription plan on the letsinteract.com platform. Processes billing name, email, and payment card data. | Mandatory, only if client uses paid subscription | Ireland (EU) — Stripe Payments Europe, Ltd., Dublin. Data stored within EEA. | Billing contact name, email address, payment card data (tokenised), billing address, subscription details. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Google LLC (Google Analytics 4) | 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | Web analytics and usage tracking for the Creator platform. Collects anonymised usage data (page views, session duration, feature interactions) to understand platform usage patterns. Active whenever a logged-in user interacts with the Creator application. | Only if client enables analytics (location tracking requires explicit client configuration) | European Union (Google EU Data Centre) | Pseudonymised user identifiers, IP addresses (anonymised), browser/device data, page URLs, session and interaction events. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Google LLC (Google OAuth / SSO) | 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | Single Sign-On (SSO) authentication via Google OAuth 2.0. Used when a platform user chooses to log in to the Creator application using their Google account. Transfers name, email address and Google account identifier upon login. | Optional, only if user selects Google login | European Union (Google EU Data Centre) | Name, email address, Google account identifier. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| LinkedIn Corporation | 1000 West Maude Avenue, Sunnyvale, CA 94085, United States | Single Sign-On (SSO) authentication via LinkedIn OAuth 2.0. Used when a platform user chooses to log in to the Creator application using their LinkedIn account. Transfers name, email address and LinkedIn profile ID upon login. | Optional, only if user selects LinkedIn login | United States | Name, email address, LinkedIn profile identifier. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Microsoft Corporation (Azure AD / Entra ID) | One Microsoft Way, Redmond, WA 98052, United States | Enterprise Single Sign-On via Microsoft Azure Active Directory (Entra ID). Used when a corporate user logs in to the Creator application using their company Microsoft account. Primarily used by enterprise clients with Microsoft 365 tenants. | Optional, only if user selects Microsoft/Azure AD login | United States (EU data residency available via Microsoft EU Data Boundary) | Name, email address, Microsoft/Azure AD account identifier, tenant ID. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| WeClapp GmbH | Lauteschlägerstraße 23, 64289 Darmstadt, Germany | ERP system used for invoicing, customer account management, and accounting. Client contact and billing data is transferred to WeClapp when a subscription is created, renewed, or a purchase order is issued. Data remains within the EU (Germany). | Mandatory, only if client has a paid subscription or purchase order | Germany (EU) | Client company name, billing contact name, email address, postal address, VAT number, subscription/order details. No transfer outside the EEA — no SCCs required. |
| Google LLC (Gmail API — Transactional Email) | 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | Transactional email delivery via Gmail API service account. Used to send platform-triggered emails such as campaign invitations, account registration confirmations, and access notifications to end-users and platform users. | Mandatory | European Union (Google EU Data Centre) | Recipient email addresses, name (where included in email), email subject and body content of platform notifications. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| HubSpot, Inc. | 25 First Street, Cambridge, MA 02141, United States (EU data hosted in Germany via HubSpot EU Data Centre) | CRM and customer account management. Stores client contact details, company information, deal history, and communication records for Interactive Paper's sales and account management operations. | Mandatory (for clients whose data is stored in CRM) | European Union (Germany — HubSpot EU Data Centre) | Client company name, billing contact name, email address, phone number, deal information, communication history. No transfer outside the EEA — no SCCs required. |
| Cloudflare, Inc. | 101 Townsend Street, San Francisco, CA 94107, United States | Reverse proxy, CDN, Web Application Firewall (WAF) and DDoS protection. All web traffic to the letsinteract.com platform and campaign landing pages is routed through Cloudflare's network before reaching the hosting infrastructure. | Mandatory | Global edge network; requests are processed at the Cloudflare data centre closest to the visitor (EU data centres for visitors in the EU). Application data at rest remains with DigitalOcean (Germany). | IP addresses, HTTP request metadata (URL, headers, user agent), security and traffic logs. Transfer basis: EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| ClickHouse, Inc. (ClickHouse Cloud) | c/o Goodwin Procter LLP, 601 Marshall St, Redwood City, CA 94063, United States | Analytics database (ClickHouse Cloud) for storing and evaluating campaign interaction and usage data that powers the campaign reports on the letsinteract.com platform. Runs on Amazon Web Services infrastructure operated on behalf of ClickHouse. | Mandatory | Germany (EU) — AWS region eu-central-1, Frankfurt | Pseudonymised end-user identifiers (incl. personalisation ID in personalised campaigns), interaction and event data, device/browser data (OS, browser, device brand and model, browser language), approximate location (country, region, city), consent flags. Transfer basis: EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |